A help-desk role that previously could only reset passwords can suddenly delete production databases in the city's cloud account. What security issue should be investigated?
Select an answer to reveal the explanation.
Short Explanation
When the help desk can drop production databases, someone handed them the master keys by accident. Hunt for over-broad IAM changes or privilege escalation, then pull those permissions back.
Full Explanation
A help-desk role that previously could only reset passwords and can suddenly delete production databases in the city's cloud account indicates privilege escalation or over-permissioned IAM changes granting excessive rights. Unexpected capability growth on low-privilege civic roles is a security incident until proven otherwise. Path MTU black holes on the database replication link are network performance issues, not IAM capability changes. DNS propagation delay after a portal cutover does not grant delete rights on databases. Cold storage retrieval fees on archived audit logs are cost concerns, not authorization expansion. Exam caveat: investigate whether the change was malicious, mistaken, or via group nesting; revoke first, then analyze—do not leave excessive rights active during review. Operational check: immediately remove excessive permissions, review IAM history and group memberships, inspect audit logs for database deletes, rotate credentials if compromise is suspected, and tighten change control for municipal IAM. In municipal cloud operations, record the chosen control and the rejected alternatives in the change or incident ticket so future on-call staff understand which failure modes were avoided for city services. Re-validate after the next maintenance window that the same decision still holds under current provider limits, identity bindings, and application versions used by the civic platform team.